Hackers are using unpatched Plex servers as crypto-miners, and yours could be at risk.

The problem with set-and-forget devices is that you can set them up and then forget about them. This is good in terms of remembering it, but people sometimes forget that their device needs regular updates to stay secure. That’s what’s happening with Plex as hackers distribute Plex2Shell to devices that haven’t been updated since August.

Plex2Shell turns unpatched Plex servers into cryptominers

Make sure your Plex server is up to date

Noticed a new wave of hackers BoredHackerBlog they invite hackers to install malware after installing the Plex honeypot. After they noticed the trend, they took to Reddit to ask if people had noticed anything from their unpatched servers:

“If you’re running an older web-facing version of plex, specifically on linux or docker, could you list the processes (the ‘ps axjf’ should also show the tree, you can see that the Plex Media Server process has a suspicious child process) and check the following:

– processes: myawesomeproxy, mylovelyminer, x12345, wget/curl download weird script file to IP address

OR

– edit command line containing: –rig-id, proxystream(.)st, –donate-level”

Naturally, people flocked to the thread to report that they had spotted the process on their Plex servers or pointed it out to other threads on the Plex subreddit. where people report malware.

This malware, called “Plex2Shell”, was reported to Plex in late July 2026; the exploit was confirmed on August 4, and information about the exploit was made public on October 16. according to the report Plex2Shell is one of four exploits usedAll Plex servers running version 1.43.3.10861 or later should be protected.

However, since people tend to leave their servers running without updating, hackers still use Plex2Shell to get into people’s servers and install cryptominers on them. If you’ve had a Plex server that hasn’t been updated in a while and it’s staring at the internet, now might be a good time to update it.